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As an alternative to the usual key generation by two-way communication in schemes for 
quantum cryptography, we consider codes for key generation by one-way communication. 
We study codes that could be applied to the raw key sequences that are ideally obtained 
in recently proposed scenarios for quantum key distribution, which can be regarded as 
communication through symmetric four-letter channels. 
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1. Introduction 

In a recently proposed protocol for quantum key distribution, 1 ' 2 Alice sends uncor- 
rected qubits through a quantum channel to Bob. Under ideal circumstances, the 
channel is noiseless, and then the situation is as follows. 

Alice prepares each qubit in one of four states — labeled A, B, C, and D, 
respectively, and chosen at random — and Bob detects each qubit in one of four 
states that are labeled correspondingly. The set-up has the peculiar feature that 
Bob never obtains the letter that specifies the state prepared by Alice. Rather, he 
always gets one of the other three letters, whereby the laws of quantum physics 
ensure that the outcome is truly random, and each possibility occurs equally likely. 

These physical laws also prevent any third party, eavesdropper Eve, from ac- 
quiring information about Alice's or Bob's letters. Therefore, they can exploit the 
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correlations between their letters to generate a private cryptographic key, which 
they can then use for the secure encryption of a message. 

The key generation is a crucial step. Two different procedures are described in 
Refs. 1 and 2, with respective efficiencies of ^ and | key bits per letter. Both proce- 
dures rely on two-way communication between Alice and Bob. By contrast, it is our 
objective here to study codes for the key generation by one-way communication. 

After the exchange of many qubits through the quantum channel, Alice and 
Bob have random sequences of the four letters, such that corresponding letters are 
never the same, while each of the twelve pairs of different letters occurs one-twelfth 
of the time, with no correlations between the pairs. Alice sends a code word to 
Bob by telling him, through a public channel, the positions at which the letters 
appear in her sequence — such as "3rd letter, then 14th, 15th, 92nd, and 65th" for 
a particular five-letter word. Bob forms the received word from his corresponding 
letters, and then decodes. 

The public communication does not leak any useful information to Eve. Thus, if 
Alice chooses a random sequence of code words, each word being equally likely, as 
she will do, Eve knows nothing about Alice's words. She also knows nothing about 
Bob's decoded words, provided that Bob's decoding procedure does not favor some 
words at the expense of others. Accordingly, the sequence of words constitutes a 
privately shared key for secure classical communication between Alice and Bob. 

There is a nonzero probability that Bob's received word is consistent with two 
or more words that Alice could have sent, so that the decoding will not be com- 
pletely error-free. A good, practical code must, therefore, represent a compromise 
between (i) having not too many code words, (ii) an acceptable error rate, and (iii) 
a reasonable efficiency. Arguably the best compromise we report in Section 8 is 
code (3) of Example f . It has 1024 words, an error rate of 0.6%, and an efficiency 
of j key bits per letter. 

As there is no fundamental reason why the key generation by one-way commu- 
nication should be substantially less efficient than that by two-way communication, 
one expects that more efficient codes can be found. Therefore, the work reported 
here should be regarded as a first step, not as the final word on the matter. 

It is worth mentioning that there is a very similar problem for the three-letter 
channel of Renes's "trine" scheme. 1 Further, the standard BB84 protocol 3 has a 
four-letter channel with quite different properties, for which codes for one-way key 
generation are not known. The same remark applies to the six-letter generalization 4 
of BB84. In short, there is a whole class of coding problems that deserve attention. 



2. Probability Distributions 

The quantum protocols of Alice and Bob involve two random variables X and 
Y taking values in {A, B, C, D}. We have the following corresponding probability 
distributions with x, y £ {A, B, C, D}. The joint probability distribution of X and 
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Y is given by 

!0 if y = x , 
1 (1) 

Accordingly, the marginal probability distributions of X and Y are 

Pr{A = x} = \ , Pr{Y = y} = \, (2) 
and the conditional probability distribution of Y with respect to X is 

!0 if y = x , 
1 (3) 
3 11 y x ■ 

Now we compute the information-theoretic quantities entropy, conditional en- 
tropy, and mutual information a of the random variables X and Y. The entropy of 

Y is 

H(Y)= -J2 Pr{r = y}log 2 Pr{r = y} = 2, (4) 

ye{A,B,C,D} 

and for the conditional entropy of Y with respect to X we find 

H(Y\X)= Pr{X = x,Y = y} log 2 Pr{y = y\X = x} = log 2 3 , (5) 

x,y G {A,B,C,D} 
y x 

and we obtain 

i(x.,r). v M^,v = »|i ne , p ;g^^» 

x,y £ {A,B,C,D} L 
y x 

= H(Y) - H{Y\X) = log 2 i (6) 
for the mutual information of X and Y. 



3. Discrete Memoryless Channel 

The information transmission from Alice to Bob can be described in information 
theory by a discrete memoryless channel. This channel is characterized by the 
conditional probability distribution" of Y with respect to X, 

!0 ify = x, 
1 (7) 
3 if y + x , 



a For the definitions of these and other information-theoretic quantities see Ref. 5, for example. 
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where x, y € {A, B,C,D}. The channel capacity 11 is defined by 



c = umxI(X;Y) = max J(P;Q), (8) 



where 



and the maximum is taken over all probability distributions P on {A, B, C, D}. 

The channel defined by (7) is a symmetric channel (see Theorem 8.2.1 on 
p. 190 in Ref. 5). Hence, the capacity is attained by the uniform distribution on 
{A,B,C,D}, so that 

c = log 2 \ = 0.4150 . (10) 

For any positive integer n, the nth extension of this discrete memoryless channel 
has the conditional probability distribution 

{0 if yt = Xi for some i, 
where x = (x\, x 2l ■ ■ ■ , x n ), y = (t/i, J/2, • ■ • , Vn) S {A, B, C, D} n are n-letter words. 



4. Codes for the Specific Channel 

In this section, we discuss the design of codes and decoding methods for the specific 
channel introduced in Section 3. 

Let F4 be the finite field with four elements. It is convenient to let A, B, C , D 
be represented respectively by the four elements 0, 1, a, b of F4 since we want to 
use linear codes for this specific channel. The addition and multiplication tables of 
F4 are as follows: 



+ 


1 a b 


X 


1 a b 





1 a b 








1 


10 b a 


1 


1 a b 


a 


a 6 1 


a 


a b 1 


b 


b a 1 


b 


6 1a 



Let F" be the n-dimensional vector space over F4. For two vectors x = 
(xi,x 2 , ■ ■ ■ ,x n ) S FJ, y = (3/1,3/2, • • • ,Vn) G F", the Hamming distance d(x,y) 
between x and y is defined as the number of coordinates in which they differ, 

d (x,y) = \{i : x, ^ y t }\ . (13) 

The Hamming weight u>(x) is the number of nonzero coordinates in x, 



(14) 
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A code of length n with M > 2 codewords is a subset C of F", 

C = {C1,C 2 ,...,C M }, Cj G FJ . (15) 

The minimum distance d{C) of the code C is the minimum Hamming distance 
between two distinct codewords, 

d(C) = min{d(x,y) : x, y G C, x ^ y} . (16) 

We denote by 

L(c t ) = {xeFJ: df^c^n} for i = 1, 2, . . . , M (17) 

the set of n- letter words that could be received if codeword c, is sent. It is easy to 
see that for any i, j, I £ {1,2,..., M} we have 

|£(c0|=3 n , (18) 
\L( Cl ) n L( Cj )\ >2 n , (19) 
\L( Cl ) L( Cj ) n L(ci)\ > 1. (20) 

Note, in particular, the significance of (20): For any three different codewords that 
could have been sent by Alice, there is at least one word received by Bob that is 
consistent with all three. 

Further, it follows from (11) that 

f ify^L(x), 

Q"(y|x)= 1 (21) 
[ - if y e L(x) . 

This means that if Alice sends x G F™ through this channel to Bob, then Bob 
receives y G L(x) with probability 1/3™. 

Now we describe a decoding method for the code C by decoding regions, which 
exploits the significance of L(ci). The M subsets D\, D2, ■ ■ ■ , D m of F™ are called 
decoding regions for the code C if they satisfy the following conditions: 

(i) ACI(ci), i = l,2,...,M; 

(ii) AnD J -=0, Mi; 

m m (22) 

(iii) |J A = |J L(a) . 

i=l i=l 

The decoding method for the code C with the decoding regions D\, • • • , -Cm is 
then: decode the received vector y into Cj if y G A- In some cases, for simplicity, 
we can construct the decoding regions in accordance with 

A = L(ci), 

A = L(c2)\L(ci), 

D i = L(c i )\ f jjL( Cj -)j , i = 2,3,...,M. (23) 
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This means that we decode the received vector y e [jfti L(ci) into the first a such 
that d(y, Cj) = n. 

Since the decoding regions of (23) refer to an agreed-upon order of the code- 
words, the decoding is biased toward the early codewords in the list at the expense 
of the later ones. Such a bias is avoided by the maximum likelihood decoding. 6 It 
can be described as follows: The received vector y G Ui!f=i ^( c i) 1S decoded into any 
codeword Ci such that <3™(y|cj) is the maximum value of Q"(y|c) over all code- 
words c e C. If there is more than one such Cj, we choose one of them at random. It 
is easy to see that this is equivalent to the following decoding method: The received 
vector y is decoded into either one of the codewords Ci that obey d(y, Cj) = n, 
choosing one at random if there are several such CjS. 



5. Decoding Error Probability 

In this section, we discuss the decoding error probability and Shannon's Channel 
Coding Theorem for the specific channel introduced in Section 3. Some criteria for 
good codes for this channel are given. 

For a code C with decoding regions D\, D2, . . ■ , Dm, the probability e, of the 
event that the vector y received by Bob is not decoded into the codeword Cj sent 
by Alice is given by 

e, = Pr{y ^ Di \ c, is sent} = 1 — Pr{y 6 Di \ c, is sent} 



1--^, i = l,2,...,M . 

on ' 



(24) 



The average error probability e is the arithmetic mean of the ejS, 

M , M 

< = — > e, = 1 



j M I M 



i=l 



1 



3 n M 
1 

3"M 
1 



1 

M 



i=l 
M 

\jLici) 



Ki<M 



3"M 

and the maximum error probability e max is the largest one of them, 

f-max — max 6^ . 
Obviously e < e max . Note that 
e = <S=^> 

ej = for all i 
^ L(a) n L(cj) = , * ^ j . 
Hence, it follows from (19) that 

^max ^ 6 > . 



(25) 
(26) 



(27) 
(28) 



Codes for Key Generation in Quantum Cryptography 7 



In particular, if the decoding regions D\, D 2 , ■ ■ ■ , Dm are given by (23), then 



ei = 1-— |L(ci)| =0, 

e< = 1 

3" 

1 

- 

1 
1 



(ci)\(u;=ii(ci) 

|i( Ci )| - |i(Ci) \ (UJC 1 ! iCCj) 

^(cOn^j-iL^)) 
Uj=i (£(<*) nL( Cj )) 



2,3,...,M. 



(29) 



The decoding error probability of a code is one of its most important per- 
formance characteristics. In this connection, we recall Shannon's Channel Coding 
Theorem (see Refs. 5 and 6). 

Theorem 1: (Shannon's Channel Coding Theorem) For any < e < 1 and 

< R < log 2 (4/3), there exists for sufficiently large n a code C of length n and size 
M = 2 nR such that e max < e, and so in particular e < e. 

Remark 1: For fixed n and M, the best we can do is to choose a code 

C = {ci,c 2 ,...,c M }, c 4 eFJ, (30) 

such that |Ui!fi -^( c i)| i s as large as possible, i.e., the average error probability e is 
as small as possible. For fixed n and e < e, in view of (25) we have to try to find a 
code C with the largest size M such that 



1 

M 



M 



;=i 



>3 n (l-e). 



(31) 



Note that for certain values of n and e, such a code C may not exist. 



6. Upper Bounds on the Decoding Error Probability 

In this section, we give several upper bounds on the decoding error probability of 
codes for our specific channel. 

Let C be a code for our specific channel. The distance distribution of the code 
C is defined by 

A s = jj\{(x,y) G C x C : d(x,y) = s}\ , s = 0,l,...,n. (32) 
It is easy to see that 

n 

a = i, J2 A * = \ C \ = M - ( 33 ) 

s=0 
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Theorem 2: Let C be a code for the specific channel in Section 3. Suppose that 
the distance distribution of the code C is given by Ao, Ai, . . . , A n . Then the average 
error probability e is upper bounded by 

e<lYA s ( 2 -X . (34) 



2 ^-J s \3 



Proof: By the definition of L(cj) in (17) we know that if d(ci, Cj) = s, then 



\L( Cl )nL(c,)\=T- s 2 s = 3 n (0 , 8 = 1,2,...., 



(35) 



Hence, 



3" M . " /2\ s 
J2 \L(c i )nL(c j )\ = —J2A s l-) . (36) 



l<j<j<M ' s=l 

By (36) and noting that |i(c»)| = 3", we obtain 



M 



M 

>2|L( Ci )|- E |i(ci)ni( Cj -)| 

i=l l<i<j<M 

= TM-^±A S {^\ . (37) 
Hence, (34) follows from (25) and (37). □ 

Theorem 3: Let C be a code for the specific channel in Section 3. If the minimum 
distance d(C) > d, then the average error probability e is upper bounded by 

M — 1 /2\ d M /2\ d 
e<— s— U <-S-U • ( 38 ) 



2 V3/ 2 \3 



Proof: If the minimum distance d(C) > d, then A s = for 1 < s < d — 1. Hence, 
by Theorem 2 and (33), 

This completes the proof. □ 

Theorem 4: Let C be a code for the specific channel in Section 3. If the minimum 
distance d(C) > d and the decoding regions Di, D 2 , ■ ■ ■ , D M are given by (23), then 
the maximum error probability e max is upper bounded by 

2\ d „/2 



e max <(M-l) - <M - . (40) 
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Proof: If the minimum distance d(C) > d, then for i ^ j, 



\L( Ci ) n L( Cj ) \ = 3»-«'(c„c i )2«i(c < ,c i ) = 3 n < gn ^_ j _ ^ 

It follows from (41) that for i = 2, 3, . . . , M, 



i-i 

U(^)n%)) 



Hence, by (29) and (42), 



i_1 /2 
< ^2\L(ci) n L(cj)| < (* - 1)3™ " 



<(M-1)3"(J) (42) 



ei=0, ei <(M-l)Q^ , i = 2,3,...,M. (43) 
Therefore, e max < (M — l)(2/3) d . □ 

7. Linear Codes 

In this section, we discuss the design of linear codes and the decoding error prob- 
ability of linear codes for our specific channel. Some criteria for good linear codes 
are given. 

First, we recall some basic concepts for linear codes. A code C over F 4 is called 
a linear [n,k] code over F 4 if C is a fc-dimensional subspace of FJ. Note that for 
a linear [n, k] code C over F4 the number of codewords is M = 4 k . Furthermore, 
we call the linear code C a linear [n, k, d] code if the minimum distance of C is 
at least d. Let Ai be the number of codewords in C of Hamming weight i. The 
sequence of numbers Aq 1 A\, . . . , A n is called the weight distribution of C. It is well 
known in coding theory 7 that for a linear code C, the distance distribution of C is 
equal to the weight distribution of C and the minimum distance of C is equal to the 
minimum Hamming weight of nonzero codewords. For fixed n and k, let di(n,k) 
be the maximal minimum distance of a linear [n, k] code over F4. Tables of lower 
and upper bounds on d±{n, k) are available in Ref. 8. 

We denote by 

A = {x = (xi,x 2 , . . . , x n ) £ : ij ^ for all i} 

= {x= (x 1 ,x 2 ,... 1 x n ) e F™ : w{x) =n} (44) 

the set of vectors with maximal Hamming weight, that is: the set of words that do 
not have the letter A. For a linear [n, k] code C over F4, by (17), it is easy to check 
that 

\jL(c)=A + C. (45) 
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Hence, by (25), the average error probability e can be rewritten as 

e=!-^l-4 + C|- W 
Note that A + C is a union of some cosets of C, 

a 

A + C = (J (a,- + C) , SLjeA, (47) 
i=i 

where ai + C, a 2 + C, . . . , a Q + C arc some different coscts of C. This implies that 
\A + C\ = a4 fc . Therefore, the average error probability e is also given by 

e " =1 -^- ( 48 ) 

Remark 2: For fixed n and fc, the best we can do is to choose a linear [n, k] code 
C over F4 such that a is as large as possible. Note that even if C is optimal in this 
sense, the average error probability may not be small. For fixed n and e < e, we 
have to try to find a linear [n, k] code C over F4 with the largest dimension k such 
that 

a>3 n (l-s). (49) 

Note that for certain values of n and e, such a linear code C may not exist. 

Remark 3: It is known from Ref. 9 (see Problem 11 on p. 114) that for our specific 
channel the codes in Shannon's Channel Coding Theorem can be replaced by linear 
codes over F4, that is, for any < e < 1 and 

-< ^l°g 2 (4/3) = 0.2075 (50) 
n 2 

there will exist, for sufficiently large n, a linear [n, k] code C over F4 such that 

a>3"(l-e). (51) 
This is equivalent to the fact that e < e. 

In general, for a linear [n, k, d] code C over F4, by Theorem 3 we have 
4 fc - 1 f2\ d 4 k /2 X d 



^ — {3) < tUJ ' (52) 

and if the decoding regions D\, D2, ■ ■ . , D^k are given by (23), then by Theorem 4, 

«W < (4* - 1) <A "(l) ■ (53) 

Furthermore, if the weight distribution {A s }™ =0 of C is known, then by Theorem 2, 



8 ^2 

S = l 
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By using the Gilbert- Varshamov quasi-random construction of linear codes, 7 
one can construct, for sufficiently large n, a linear [n, k] code C over F 4 with size 

M = 4 fe = fl'-^W")! (55) 
such that the minimum distance d{C) > d, where 

3 

Hi(x) — xlog 4 3 — xlog^x — (1 — x)log 4 (l — x) , < x < — . (56) 
It follows from (53) that the maximum error probability e max is upper bounded by 

6max < $ d = 4 n[l-J?4(d/n)+(d/n) log 4 (2/3)] _ (57) 

The function of d/n in the exponent is such that 

2 

1 - H A {x) +x\og A - < x > (3, (58) 

where /3 = 0.4627 is the unique solution of 1 — H^{x) +xlog 4 (2/3) = 0. This means 
that, for sufficiently large n, one can construct a linear [n, k] code C over F 4 with 
the rate 

- = 1 - H 4 (/3) = 0.1353 (59) 
n 

such that the maximum error probability e max is arbitrarily small. 



8. Some Examples 

In this section we give some examples of linear codes for the specific channel in 
Section 3 to illustrate our results. These linear codes arc listed in Brouwer's tables 8 
of presently best known quaternary linear codes. The value of R is obtained from 
M = 2 nR in Theorem 1 and corresponds to the efficiency mentioned in Section 1. 

In Table 1 we give the parameters of various codes from Ref. 8. They illustrate 
a general observation, namely that there is a trade-off between the simplicity of the 
code (short length n of the words, small number M of them) on one side and the 
performance of the code (large efficiency R, small average error e). In addition to 
the codes of Table 1, we mention the following four codes of moderate length and 
reasonably good performance. 

Example 1: Here we list explicitly known linear codes of moderate lengths. 
(1) A code with n = 28 , k = 4 , d = 20 , M = 256 for which R = f = 0.2857 and 

e < ^(2/ 3) 20 = 0.03 8 49 is the upper bound of (52). 

As is known from Ref. 8, there exists a linear [28, 4, 20] code over F 4 with the 
weight distribution A 2 o = 189 , A 2 4 — 63 , A 2 % = 3, so that (54) gives the 
bound e < 0.03038. 
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Table 1. Examples of linear codes for the channel specified by the conditional probability distri- 
bution (7). For each code we give the number n of letters in each codeword, the dimension k of 
the subspacc of F™, the minimum Hamming distance d, the total number M of codewords, the 
efficiency R, and in the last column an upper bound of (52) on the average error probability e, 
rounded to four significant digits. 

The first group on the left are six codes of length n = 100 with consecutive values of the dimen- 
sion k. For k > 16, the upper bound on e is greater than 1, and so it is not meaningful. The second 
group on the left are two codes of large lengths which demonstrate that the error probability can 
be made very small. The group on the right are 14 codes with lengths decreasing from 50 to 10. 



n 


k 


d 


M 


R 


e < 




n 


k 


d 


M 


R 


e < 






100 


10 


62 


4 io 


0.2 


6.337 x 10" 


6 


50 


5 


35 


1024 


0.2 


3.516 x 


10" 


-4 


100 


11 


60 


4 n 


0.22 


5.704 x 10~ 


5 


50 


6 


33 


4096 


0.24 


3.165 x 


10" 


-3 


100 


12 


58 


4 12 


0.24 


5.133 x 10- 


4 


48 


6 


32 


4096 


0.25 


4.747 x 


10" 


-3 


100 


13 


56 


4 13 


0.26 


4.620 x 10- 


3 


48 


5 


33 


1024 


0.208 


7.912 x 


io- 


-4 


100 


14 


55 


4 14 


0.28 


0.02772 




47 


6 


31 


4096 


0.255 


7.120 x 


io- 


-3 


100 


15 


52 


4 15 


0.30 


0.3742 




46 


5 


32 


1024 


0.217 


1.187 x 


io- 


-3 
















45 


5 


31 


1024 


0.222 


1.780 x 


io- 


-3 
















43 


5 


30 


1024 


0.233 


2.670 x 


io- 


-3 
















42 


5 


29 


1024 


0.238 


4.005 x 


io- 


-3 


200 


20 


109 


4 20 


0.2 


3.517 x 10- 


8 


41 


5 


28 


1024 


0.244 


6.008 x 


io- 


-3 


250 


25 


136 


4 25 


0.2 


6.340 x 10- 


10 


40 


4 


28 


256 


0.2 


1.502 x 


io- 


-3 
















30 


3 


22 


64 


0.2 


4.277 x 


io- 


-3 
















20 


2 


16 


16 


0.2 


0.01218 




















10 


1 


10 


4 


0.2 


0.02601 







(2) A code with n = 31 , k = 4 , d = 22 , M — 256 for which R = = 0.2581 and 
e < ^(2/3) 22 = 0.01711 is the upper bound of (52). 

As is known from Ref. 8, there exists a linear [31, 4, 22] code over F4 with the 
weight distribution A 22 = 141, A 2 a = 87, A 2 $ = 24, A 3Q = 3, so that (54) 
gives the bound e < 0.01216. 

(3) A code with n = 40, k = 5 , <i = 28, M = 1024 for which R = \ = 0.25 and 
e < ^(2/3) 28 = 0.006008 is the upper bound of (52). 

As is known from Ref. 8, this optimal linear code is a quasi-cyclic code. The 
generator matrix can be represented as G = [Go, G\, G 2 , G3, G4, G5, Gq, G7] 
where G% for < i < 7 arc 5x5 circulant matrices. The first row of G is given 
by [10000 10120 11020 11230 12220 13130 13210 11312] , where we 
identify 2 with a £ F4 and 3 with b e F4. 

(4) The shortened code of the previous example: n = 39 , k = 4 , d = 28 , M = 256 
for which R = ^ = 0.2051 and e < ^(2 /3) 28 = 0.00 1 502. 

Remark 4: For codes of small size, one can calculate the exact values of , e, and 
e m ax by using (24)-(29). The decoding method is also computationally feasible. 
For codes of large size, for example M = 4 20 , decoding will become an enormous 
computational task. 

Remark 5: By using nonlinear codes, it may be possible to achieve better re- 
sults on the decoding error probability, but we have not tried to search for good 
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quaternary nonlinear codes in the literature. 
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